Re: XML_Feed_Parser and HTML security

Actually have a sample Safe class in the docs would be the same thing as telling the user to use HTML_Safe, most wouldn't and would complain anyhow. I do not agree on putting a small class aside that would extend, although what we could do is a flag in the package.xml that states that this package's output should be escaped: <installMSG>Output Should be escaped using HTML_Safe</installMSG> Then when installing: root@serependity:/home/david# pear install PEAR_Package-alpha downloading PEAR_Package-0.0.1.tgz ... Starting to download PEAR_Package-0.0.1.tgz (8,358 bytes) .....done: 8,358 bytes Info: Output should be escaped using HTML_Safe install ok: channel://pear.php.net/PEAR_Package-0.0.1 But yes, that would involve adding some stuff to the pear installer, and more xml parsing, maybe it's a little too overhead but for long term I believe that this could be a cool way of doing stuff. Even a tag <safeHTML/> that would output the message automatically. So the Info message and the docs should give the users an idea that this is important .. I guess they would understand but again.. i am not everyone :-)